Understanding
the App Lifecycle:
Automate Updatingand Deploying
Managing apps through their lifecycle — from sourcing to updating to theexperience users have — is a critical component of an IT admin’s job. It’s also
something that often goes unconsidered or is left in a state of good enough.
But all too often the workflow is not good enough, creates more work andheadaches for IT, and may disrupt the user experience in the long run.
By considering the approach to each step of the app lifecycle workflow, IT candeliver a flawless experience for end users while keeping an eye on compatibility
issues and security risks that come with outdated software. A major component of
the workflow that aids in keeping up with compatibility issues is patch management.

This solution brief explains:• T he basics of updating and deploying apps•W
 hy should you patch software• A pp Installers in Jamf Pro• P atch Management in Jamf Pro

Basics of updating and deploying apps
Much of an application’s lifecycle is spent updating and deploying that app. Volume Purchasing
through Apple Business Manager or Apple School Manager automatically updates apps as newversions become available, however, many applications used for business come from outside
the Mac App Store, like Google Chrome or the Adobe Suite. For these apps, a little more work isneeded to update and deploy.
Patch management is the process of updating these apps and, while necessary, can be a time
consuming and manual task for IT admins. First, let’s talk about why patch management isnecessary for software environments.

Why should you patch software?
Updating software to take advantage of new features requested by users.
Major (and minor) point-releases of software often bring new features, which users
are likely to request well before IT has been made aware of any such point-release.
Updating software to take advantage of bug fixes can decrease the numberof tickets submitted to IT support teams.
While users appreciate new features being added to business-criticalapplications, system administrators also appreciate a less bug-ridden
environment, decreasing the ticket workload of IT support teams.
Updating software to quickly respond to security vulnerabilities.
This ServiceNow study found that it takes 43 days for a cyberattack to be
attempted once a patch for a security vulnerability has been released, with 60%of survey respondents who experienced a data breach reporting the breach may
well have been avoided had the relevant patch been applied.

Why doesn’t everyone immediately patch software?
The same ServiceNow study found that the common reasons for a delay in patching were:• A lack of available or usable resources needed for patching.
• No single view of installed applications and devices.
• No ability to schedule downtime for patching.
Luckily, Jamf Pro can assist on all three fronts.

How to update appswith Jamf Pro
Jamf Pro offers admins two different
workflows to achieve their patch
management goals: App Installers andpatch policy workflows. App Installers brings
automation to the patch management

Version history
A version history is a collection of software
versions alongside their corresponding release dates.
Although useful for determining whether a software title
has patches available, this often is not enough information
for an administrator to make an informed decision on thecomplexity involved in patching the affected title.

process to reduce time spent sourcing andThe Jamf patch management titles include details critical

deploying new versions, while patch policy

to the patching process for each and every software title

workflows are far more manual but may beversion, such as whether a patch requires a reboot of themore familiar to Apple administrators, sincemacOS device, the minimum macOS version required, as

they have been the only option for Jamf

well as which applications must quit in order for the patch

patch management in the past.

to be applied.

Automated patch workflows with App Installers
One method of keeping apps up-to-date is with automated updates. App Installers, part of theJamf App Catalog – offers a streamlined way to deploy and update third-party Mac applications,removing the tedious tasks of sourcing, deploying and maintaining application titles.

How App Installers keep apps up-to-date automatically
App Store and Vendor-sourced apps in one place
The App Store was revolutionary when it created a marketplace of applications a user
may want on their device. Jamf Pro makes sourcing both Mac App Store and third-party
applications easy, via the Jamf App Catalog. App Installers offer a simplified “automaticupdate” workflow, meaning updating apps has a low maintenance point.
Admins can select which applications from the Jamf App Catalog they wish to target for
patch policies, as well as external patch definition feeds. In addition to the expanding listof titles available, Jamf Title Editor provides admins with the ability to create and maintaintheir own custom titles within the Jamf App Catalog, or customize information provided byJamf app title definitions.

STEP 1

AutomaticallySource, Host andPackage Apps

Jamf monitors and sources new versions of apps
directly from the vendor and once a new version
is available, Jamf downloads the new version,
repackages if needed and uploads it to thedistribution point. Once uploaded, Jamf Pro links thepackage to the patch definition.

STEP 2

App security
throughpackaging

Before apps can be deployed, the integrity of the patch
definition needs to be validated to ensure security. Onceverified, the new app version will be deployed automaticallyto all compatible Mac in the Smart Group designated by theadmin. This install is silent in the background so users do notneed to take any action.Patch management workflows
in Jamf Pro
Alternatively, admins may choose to use patch policy
workflows in Jamf Pro to patch apps, or a combination withApp Installers. Admins can select applications from the Jamf

What’s in a version?
For the purposes of patch
management, Jamf Pro uses anapplication’s name (.app) and bundleidentifier (CFBundleIdentifier) in order
to identify a software title, as well as

App Catalog they wish to target for patch policies.

the application’s short version string

Jamf Pro collects inventory containing a wealth ofto assess the software title’s version.

information about each enrolled device, including
a comprehensive list of software titles installed, along withthe software’s version information.
Version history is important as it tells admins when an app
is outdated. With Jamf Pro’s patch management feature,admins can subscribe to an ongoing feed of software
version data, empowering them with timely reporting
information, as well as with the abilty too take action andpatch a device.
Jamf Pro combines inventory data and software version data
to produce timely reports on software compliance, as wellas equipping a Jamf Pro administrator with the informationnecessary in order to undertake the patching process.

(CFBundleShortVersionString) in order

To use Google Chrome as an
example:App name: Google Chrome.app
CFBundleIdentifier:com.google.Chrome
CFBundleShortVersionString:
88.0.4324.150

In some cases, a software title mightuse alternate methods of reporting
its version information, such asa configuration file in a non-standard
location, or is only accessible via thecommand line. In these instances,
Jamf Pro uses an extension attribute,which allows Jamf Pro to collect extra
inventory information in order to querya software title’s version.

STEP 1

Tracking a software
title with Jamf Pro

STEP 2

Building
reports

STEP 3

Get notified

Patch management software titles can be configured
for reporting and updating purposes. If a software
title requires the use of an extension attribute inorder to collect versioning information, any scripts
required will be presented for acceptance, ensuring
full transparency of the data collection process.

Generate reports to identify which computers have the software title
installed and which titles need to be patched. Reports can be displayedon a Jamf Pro dashboard to provide an instant overview of software
compliance or exported as either a comma-separate values file (.csv), ora tab-delimited text file (.txt).
For greater visibility, leverage advanced computer searches and smart
computer groups for a comprehensive state of the environment.

Configure Jamf Pro to notify administrators of mission-critical software
title update availability and users on a per-software title basis allowing
them to update on their own. If provisioned with a Jamf Pro account,a security team can also be notified alongside an administrator,
allowing them to work in tandem.
This is critical as ServiceNow reports that 62% of respondents said
they were unaware of any vulnerabilities. Had they been notified, they
may have been able to take immediate action and patch the issue.

STEP 4Patch

With software titles added to Jamf Pro, an administrator is given full control
over the deployment of any required patches through the creation of patch
policies, a patch-specific variant of a regular Jamf Pro policy.
includes choosing whether to distribute patches automatically or making
them available for users in Jamf Self Service, which can also notify users via
Notification Center. Both a decline and grace period can also be added, sothat users can install updates at a time of their choosing, rather than that of IT.

Simplified app management with Jamf
As organizations grow, so does the need for easier app management.
Maintaining a healthy application environment – especially keeping apps
up-to-date – is a vital part to any IT admins job. Whether manually updating
titles via patch management, or using a more automated process with App
Installers, sourcing, deploying and updating applications with Jamf Pro has
never been easier.
This is just the beginning. Jamf continues to invest in new workflows in orderto help IT admins be successful with Application Lifecycle Management,
however a software environment is set up.

To learn more and put our App Lifecycle Management workflows to the test,
start your free trial today.
Or contact your preferred reseller of Apple hardware to get started.